@lists: "Hey guys,
since a week or two all my mail servers are receiving a massive amount 
of emails which passes by all my rules in SA (even Bayes doesn't stand a 
chance as the content is written to good).
I wondered if somebody else has this problem and has some advice 
regarding rules.
Here some of the subjects of these emails:
- Bist DU mein Traumtyp??
- Willst Du spass haben?
- Shireen gepoppt.
- Saga direkt gevoegelt hehe
- L0litas wollen es richtig hart
- Myriam naturgeiles Teenie!
Thanks for your help.
Best regards
Christoph"
    @mouss: "Christoph Petersen a �crit :
<quote>
you'd better show a full message (use pastebin or put it on your own web
page ...).
You can try the "German Language Ruleset"
	<url>
with sa-update, the channel is
	70_zmi_german.cf.zmi.sa-update.dostech.net
See
	<url>
for how to access sare channels."
    @lists: "Hi.
<quote>
Mhh my bayes identifies some of them with even 99% but it's not enough 
to stop all of them.
BR
Christoph"
    @lists: "Hi Chris,
<quote>
Thanks for pointing that out. Will check on adding these plugins/rules 
into SA.
BR
Christoph"
    @beta: "Am/On Sat, 18 Oct 2008 05:20:03 -0700 schrieb/wrote cfgerty:
<quote>
this message doesn't come from a mail-server with a resolving reverse =
pointer.
We don't accept such messages, so this message even wouldn't make it to
spamassassin here.
Thanks and all the best
Matthias"
    @mouss: "Matthias Schmidt a �crit :
<quote>
which mail server do you mean? My understanding is that Chritoph gets
the mail via his ISP, and his ISP doesn't perfrom rDNS lookup.
Christoph: can you confirm this?
Other than that, the server that pushed it has a "dynamic" rdns:
$ host 83.161.120.155
83.161.120.155.in-addr.arpa domain name pointer
83.161.120.155.dynamic.cablesurf.de.
$ host 83.161.120.155.dynamic.cablesurf.de
83.161.120.155.dynamic.cablesurf.de has address 83.161.120.155
and if the ISP relay is trusted, then the mail is "direct to mx", which
could deserve few points.
Also, that IP is listed in bb.barracudacentral.org (2.0 here. I am
considering increasing the score as I didn't see it FP).
another note: The spam contains an obfuscated uri (geheime-webcam....)
which is listed on surbl and uribl (since 2008-10-05)."
    @mouss: "Chris a �crit :
<quote>
hmmm...
* RDNS_NONE is bogus here. The host does have rdns, it's just that the
(ISP?) MTA didn't look it up. Fortunately, 0.1 is small enough.
* For the same reason, RELAYED_BY_DIALUP looks bogus to me as well. does
this plugin perform rDNS lookup? or does the botnet plugin correct the
X-Relay-* meta headers?
* 5.0 for dynamic rDNS may be too high depending on site policy
regarding dynamic rdns."
    @mouss: "cfgerty a �crit :
<quote>
are there any legitimate uses of such spacings?
Otherwise, you could play with something like:
describe        URI_SPACE       body contains a spaced URI.
body            URI_SPACE
/www[\s\.\-]{1,3}[^\s\.]{1,20}[\s\.\-]{1,3}(?:org|com|net)/
score           URI_SPACE       0.01"
{'source': 'USENET', 'other_information': '{"reply_count": 7, "forum_name": "mailing.unix.spamassassin-talk.20140827.mbox"}', 'file': 'data/output/usenet-mailing.unix.parquet'}